SandStorm Hackers Added New Kapeka Tool to it’s Arsenal

Kapeka, also is named KnuckleTouch, is a complex backdoor malware that has been making waves in the cybersecurity world.

First and predominant performing in mid-2022, it wasn’t till 2024 that Kapeka modified into formally tracked as a consequence of its involvement in miniature-scope attacks, significantly in Jap Europe.

The Sandstorm Connection Kapeka is linked to the Sandstorm Neighborhood, operated by Russia’s Navy Unit 74455, known for its disruptive cyber actions.

This team, on the whole is named Sandworm, has a historical previous of focusing on Ukraine’s essential infrastructure amidst geopolitical tensions.

Kapeka shows a unfold of developed functionalities, including initialization, expose-and-management (C2) communique, task execution, and persistence mechanisms.

Kapeka utilizes a dropper malware to provoke the infection course of.

This dropper deploys the precise backdoor file (a Home windows DLL) disguised as a “.wll” file and positions it inside arrangement directories devour “ProgramData” or “AppData.”

To originate distinct actual operation, Kapeka employs a few persistence mechanisms:

• Autorun Registry: Modification alters the autorun registry key to attain the backdoor file upon arrangement startup.
• Scheduled Duties: It creates a scheduled task the usage of “schtasks.exe” to discontinue persistence, especially if the initial draw fails as a consequence of privilege limitations.
• Batch File Putting off: A batch file is dropped to earn rid of the distinctive dropper after successful backdoor deployment.

C2 Communique and Efficiency Highlights

Kapeka communicates with its expose-and-management (C2) server the usage of the WinHttp API, exchanging data in JSON format.

The C2 configuration is encrypted with AES-256 for enhanced security.

Right here’s a breakdown of Kapeka’s key functionalities:

• Initialization and Fingerprinting: It gathers files referring to the sufferer’s arrangement (running arrangement essential aspects, usernames, machine/domain names) thru arrangement calls and registry searches. This data is then converted to JSON for transmission.

Task Execution: In step with C2 server commands, Kapeka can compose numerous actions on the compromised arrangement, including:

• Self-uninstallation
• Downloading files from the C2 server
• Uploading files to the C2 server
• Executing commands or launching original processes
• Updating itself with a extra most up-to-date version
• Working shell commands

These aspects pose essential challenges to detection and underline the backdoor’s developed capabilities.

Publish Investigation, LOGPOINT recommends organizations leverage security instruments devour SIEM (Safety Records and Tournament Administration) alternatives to detect suspicious actions.

Right here are some doable indicators of compromise (IOCs) to ogle for:

• Registry key modifications connected to autorun entries containing suspicious file paths (e.g.,”AppDataNativeMicrosoftjagyg.wll”)
• Scheduled initiatives with ordinary names devour “Sens Api” referencing particular commands.
• Processes connected to “rundll32.exe” executing “.wll” files positioned in non-fashioned directories.